bpf: Improve JEQ/JNE branch taken logic
authorAndrii Nakryiko <andrii@kernel.org>
Sun, 22 Oct 2023 20:57:37 +0000 (13:57 -0700)
committerDaniel Borkmann <daniel@iogearbox.net>
Tue, 24 Oct 2023 12:45:51 +0000 (14:45 +0200)
commit42d31dd601fa43b9afdf069d1ba410b2306a4c76
treee018bf2cea6bc60112aef36047781ccb59c31f1f
parent06646da01458682023321bdc7553b8140e95d077
bpf: Improve JEQ/JNE branch taken logic

When determining if an if/else branch will always or never be taken, use
signed range knowledge in addition to currently used unsigned range knowledge.
If either signed or unsigned range suggests that condition is always/never
taken, return corresponding branch_taken verdict.

Current use of unsigned range for this seems arbitrary and unnecessarily
incomplete. It is possible for *signed* operations to be performed on
register, which could "invalidate" unsigned range for that register. In such
case branch_taken will be artificially useless, even if we can still tell
that some constant is outside of register value range based on its signed
bounds.

veristat-based validation shows zero differences across selftests, Cilium,
and Meta-internal BPF object files.

Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Shung-Hsi Yu <shung-hsi.yu@suse.com>
Link: https://lore.kernel.org/bpf/20231022205743.72352-2-andrii@kernel.org
kernel/bpf/verifier.c